CVE-2026-116779: SignalWire FreeSWITCH Code Injection — KEV-Confirmed Exploitation, Detection & Emergency Mitigation Guide

---
title: FreeSWITCH Process Spawning System Command Execution
id: a1b2c3d4-1167-4e5f-8a9b-cve2026116a1
status: experimental
description: Detects the FreeSWITCH process (freeswitch) spawning shell interpreters, command execution utilities, or download tools. This behavior is consistent with post-exploitation command execution via CVE-2026-116779 code injection, where an attacker leverages FreeSWITCH's system API or scripting modules to execute OS-level commands.
references:
  - https://www.cisa.gov/known-exploited-vulnerabilities-catalog
  - https://attack.mitre.org/techniques/T1059/
  - https://attack.mitre.org/techniques/T1190/
author: Security Arsenal
date: 2026/11/09
tags:
  - attack.execution
  - attack.t1059
  - attack.t1190
  - attack.initial_access
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|endswith:
      - '/freeswitch'
      - '/freeswitch.bin'
  selection_child_shell:
    Image|endswith:
      - '/bash'
      - '/sh'
      - '/dash'
      - '/zsh'
      - '/python'
      - '/python3'
      - '/perl'
      - '/php'
  selection_child_tool:
    Image|endswith:
      - '/curl'
      - '/wget'
      - '/nc'
      - '/ncat'
      - '/netcat'
      - '/socat'
      - '/base64'
      - '/chmod'
      - '/chown'
      - '/crontab'
  condition: selection_parent and (selection_child_shell or selection_child_tool)
falsepositives:
  - Legitimate FreeSWITCH dialplan applications that invoke system commands (rare in hardened environments)
  - Custom FreeSWITCH scripts using mod_lua or mod_python for call processing
level: critical
---
title: Unauthorized Access to FreeSWITCH Configuration and Credential Files
id: a1b2c3d4-1167-4e5f-8a9b-cve2026116a2
status: experimental
description: Detects non-FreeSWITCH processes accessing FreeSWITCH configuration files that contain SIP credentials, API keys, TLS private keys, and gateway authentication tokens. This is consistent with the credential disclosure impact of CVE-2026-116779, where attackers exfiltrate configuration data after gaining code execution.
references:
  - https://www.cisa.gov/known-exploited-vulnerabilities-catalog
  - https://attack.mitre.org/techniques/T1552/
  - https://attack.mitre.org/techniques/T1003/
author: Security Arsenal
date: 2026/11/09
tags:
  - attack.credential_access
  - attack.t1552
  - attack.t1552.001
logsource:
  category: file_access
  product: linux
detection:
  selection_paths:
    TargetFilename|contains:
      - '/freeswitch/conf/'
      - '/freeswitch/conf/sip_profiles/'
      - '/freeswitch/conf/directory/'
      - '/freeswitch/conf/vars.xml'
      - '/freeswitch/conf/autoload_configs/'
  selection_sensitive_files:
    TargetFilename|endswith:
      - 'sip_profiles/internal.xml'
      - 'sip_profiles/external.xml'
      - 'vars.xml'
      - 'event_socket.conf.xml'
      - 'acl.conf.xml'
  exclusion_freeswitch:
    Image|endswith:
      - '/freeswitch'
      - '/freeswitch.bin'
      - '/fs_cli'
  exclusion_admin:
    Image|endswith:
      - '/systemd'
      - '/rsyslogd'
      - '/logrotate'
      - '/fail2ban'
  condition: (selection_paths or selection_sensitive_files) and not (exclusion_freeswitch or exclusion_admin)
falsepositives:
  - System administrators manually reviewing configuration files
  - Configuration management tools (Ansible, Puppet, Chef) applying updates
  - Backup agents performing scheduled backups
level: high
---
title: Suspicious Network Connection to FreeSWITCH Event Socket Port
id: a1b2c3d4-1167-4e5f-8a9b-cve2026116a3
status: experimental
description: Detects inbound network connections to the FreeSWITCH Event Socket Library (ESL) port 8021 from IP addresses outside expected management subnets. ESL provides full API control over FreeSWITCH, and unauthorized access attempts are consistent with CVE-2026-116779 exploitation or post-compromise command and control.
references:
  - https://www.cisa.gov/known-exploited-vulnerabilities-catalog
  - https://attack.mitre.org/techniques/T1190/
  - https://attack.mitre.org/techniques/T1071/
author: Security Arsenal
date: 2026/11/09
tags:
  - attack.initial_access
  - attack.t1190
  - attack.command_and_control
logsource:
  category: network_connection
  product: linux
detection:
  selection_port:
    DestinationPort: 8021
  selection_direction:
    Initiated: 'false'
  condition: selection_port and selection_direction
falsepositives:
  - Legitimate FreeSWITCH management connections from authorized administrators
  - Monitoring systems performing health checks via ESL
  - FreeSWITCH clustering with fs_cli connections from peer nodes
level: high

// Hunt for suspicious child processes spawned by FreeSWITCH
// Detects potential CVE-2026-116779 post-exploitation command execution
Syslog
| where TimeGenerated > ago(72h)
| where ProcessName =~ "freeswitch" or SyslogMessage has "freeswitch"
| where SyslogMessage has_any ("system", "exec", "bash", "sh -c", "curl", "wget", "chmod", "nc ", "python")
| where SyslogMessage !has_any ("mod_spandsp", "mod_conference", "normal_clearing")
| project TimeGenerated, Computer, ProcessName, SyslogMessage, SeverityLevel
| order by TimeGenerated desc

// Identify unauthorized connections to FreeSWITCH ESL port
// Filter for external or non-management subnet sources
CommonSecurityLog
| where TimeGenerated > ago(72h)
| where DestinationPort == 8021
| extend SourceIPType = iff(ipv4_is_private(SourceIP), "Internal", "External")
| summarize ConnectionCount = count(), UniqueSources = dcount(SourceIP), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated) by SourceIP, SourceIPType, DestinationIP, DeviceAction
| where SourceIPType == "External" or ConnectionCount > 50
| order by ConnectionCount desc

// Detect unauthorized reads of FreeSWITCH configuration and credential files
// Requires auditd or Sysmon for Linux with file access rules
SecurityEvent
| where TimeGenerated > ago(72h)
| where EventID == 4663
| where ObjectName has_any ("freeswitch", "sip_profiles", "vars.xml", "event_socket", "acl.conf")
| where ProcessName !endswith "freeswitch"
| where ProcessName !endswith "fs_cli"
| project TimeGenerated, Computer, Account, ProcessName, ObjectName, AccessMask
| order by TimeGenerated desc

// Detect anomalous SIP REGISTER/INVITE patterns consistent with
// credential stuffing or toll fraud following credential theft via CVE-2026-116779
CommonSecurityLog
| where TimeGenerated > ago(24h)
| where DestinationPort in (5060, 5061)
| where ApplicationProtocol =~ "SIP" or Message has_any ("REGISTER", "INVITE", "403", "401")
| summarize AuthAttempts = count(), UniqueDestinations = dcount(DestinationIP), FailureCount = countif(Message has "403" or Message has "401") by SourceIP, bin(TimeGenerated, 15m)
| where AuthAttempts > 100 or FailureCount > 50
| extend FailureRate = round(todouble(FailureCount) / todouble(AuthAttempts) * 100, 1)
| order by AuthAttempts desc

-- CVE-2026-116779 FreeSWITCH Post-Exploitation Triage
-- Hunts for suspicious child processes of FreeSWITCH, modified config files,
-- and active network connections on FreeSWITCH service ports

-- Part 1: Identify FreeSWITCH processes and their children
LET freeswitch_procs = SELECT Pid, Name, Exe, CommandLine, Username
FROM pslist()
WHERE Name =~ 'freeswitch'

LET suspicious_children = SELECT Pid, Ppid, Name, Exe, CommandLine, Username, CreateTime
FROM pslist()
WHERE Ppid IN (SELECT Pid FROM freeswitch_procs)
  AND (Name =~ 'bash|sh|dash|zsh|python|perl|php'
       OR Exe =~ '/curl|/wget|/nc|/ncat|/socat|/base64|/chmod|/crontab'
       OR CommandLine =~ 'base64|/dev/tcp|reverse|shell|chmod \+x|crontab')

-- Part 2: Check for recently modified FreeSWITCH configuration files
LET config_modifications = SELECT FullPath, Mtime, Size, Mode
FROM glob(globs=[
  '/etc/freeswitch/**/*.xml',
  '/etc/freeswitch/**/*.conf',
  '/usr/local/freeswitch/conf/**/*.xml',
  '/usr/local/freeswitch/conf/**/*.conf',
  '/opt/freeswitch/conf/**/*.xml'
])
WHERE Mtime > now() - 259200
ORDER BY Mtime DESC

-- Part 3: Active network connections on FreeSWITCH ports
LET fs_connections = SELECT Pid, Name, LocalAddr, LocalPort, RemoteAddr, RemotePort, State
FROM netstat()
WHERE LocalPort IN (5060, 5061, 8021, 8081, 8082)
   OR RemotePort IN (5060, 5061, 8021, 8081, 8082)

-- Combine results
SELECT 'suspicious_child' AS FindingType, Pid, Ppid, Name, Exe, CommandLine, Username, CreateTime AS Timestamp, '' AS ExtraInfo
FROM suspicious_children
UNION ALL
SELECT 'config_modification' AS FindingType, 0 AS Pid, 0 AS Ppid, '' AS Name, '' AS Exe, '' AS CommandLine, '' AS Username, Mtime AS Timestamp, FullPath AS ExtraInfo
FROM config_modifications
UNION ALL
SELECT 'network_connection' AS FindingType, Pid, 0 AS Ppid, Name, '' AS Exe, '' AS CommandLine, '' AS Username, now() AS Timestamp, format(format='%v:%v -> %v:%v (%v)', args=[LocalAddr, LocalPort, RemoteAddr, RemotePort, State]) AS ExtraInfo
FROM fs_connections

#!/bin/bash
# ============================================================
# CVE-2026-116779 Emergency Mitigation & Hardening Script
# SignalWire FreeSWITCH Code Injection — Active Exploitation
# CISA KEV Added: 2026-11-09
# ============================================================
# RUN AS ROOT. Test in staging first if possible.
# This script performs network-level lockdown as an interim measure.
# APPLY THE VENDOR PATCH AS SOON AS IT IS AVAILABLE.
# ============================================================

set -euo pipefail
LOG="/var/log/cve-2026-116779-mitigation-$(date +%Y%m%d-%H%M%S).log"

echo "[$(date)] CVE-2026-116779 Emergency Mitigation Starting" | tee "$LOG"

# --- STEP 1: Identify FreeSWITCH installation ---
echo "[$(date)] Locating FreeSWITCH installation..." | tee -a "$LOG"
FS_BINARY=$(which freeswitch 2>/dev/null || find /usr /opt /usr/local -name "freeswitch" -type f 2>/dev/null | head -1)
FS_CONF_DIRS=("/etc/freeswitch" "/usr/local/freeswitch/conf" "/opt/freeswitch/conf")
FS_CONF=""
for dir in "${FS_CONF_DIRS[@]}"; do
  if [ -d "$dir" ]; then
    FS_CONF="$dir"
    echo "[$(date)] Found config directory: $FS_CONF" | tee -a "$LOG"
    break
  fi
done

if [ -z "$FS_BINARY" ]; then
  echo "[$(date)] WARNING: FreeSWITCH binary not found. Is FreeSWITCH installed?" | tee -a "$LOG"
fi

# --- STEP 2: Capture pre-mitigation forensic snapshot ---
echo "[$(date)] Capturing forensic snapshot..." | tee -a "$LOG"
SNAPSHOT_DIR="/tmp/fs-forensics-$(date +%Y%m%d-%H%M%S)"
mkdir -p "$SNAPSHOT_DIR"

# Process tree
ps auxf > "$SNAPSHOT_DIR/process_tree.txt" 2>/dev/null

# FreeSWITCH process details
pgrep -a freeswitch > "$SNAPSHOT_DIR/freeswitch_processes.txt" 2>/dev/null || true

# Network connections
ss -tlnp > "$SNAPSHOT_DIR/listening_ports.txt" 2>/dev/null
ss -tnp state established > "$SNAPSHOT_DIR/established_connections.txt" 2>/dev/null

# FreeSWITCH-specific connections
ss -tnp | grep -E ':(5060|5061|8021|8081|8082)' > "$SNAPSHOT_DIR/fs_connections.txt" 2>/dev/null || true

# Recently modified config files (last 72 hours)
if [ -n "$FS_CONF" ]; then
  find "$FS_CONF" -type f -mtime -3 -exec ls -la {} \; > "$SNAPSHOT_DIR/recently_modified_configs.txt" 2>/dev/null
fi

# FreeSWITCH logs (last 500 lines)
for logdir in /var/log/freeswitch /usr/local/freeswitch/log /opt/freeswitch/log; do
  if [ -d "$logdir" ]; then
    tail -500 "$logdir"/freeswitch.log > "$SNAPSHOT_DIR/freeswitch_log_tail.txt" 2>/dev/null || true
  fi
done

# Cron jobs
for user in $(cut -d: -f1 /etc/passwd); do
  crontab -u "$user" -l 2>/dev/null | sed "s/^/[$user] /" >> "$SNAPSHOT_DIR/cron_jobs.txt" || true
done

echo "[$(date)] Forensic snapshot saved to $SNAPSHOT_DIR" | tee -a "$LOG"

# --- STEP 3: Lock down ESL (Event Socket Library) port 8021 ---
echo "[$(date)] Locking down ESL port 8021..." | tee -a "$LOG"

# Check if ESL is bound to 0.0.0.0 (dangerous) vs 127.0.0.1 (safe)
ESL_CONFIG=$(find "$FS_CONF" -name "event_socket.conf.xml" 2>/dev/null | head -1)
if [ -n "$ESL_CONFIG" ]; then
  echo "[$(date)] ESL config found: $ESL_CONFIG" | tee -a "$LOG"
  grep -i "listen-ip" "$ESL_CONFIG" | tee -a "$LOG"

  # Backup original
  cp "$ESL_CONFIG" "${ESL_CONFIG}.bak.cve2026116779"

  # Force ESL to localhost only
  sed -i 's|<param name="listen-ip" value="[^"]*"/>|<param name="listen-ip" value="127.0.0.1"/>|' "$ESL_CONFIG"
  echo "[$(date)] ESL listen-ip forced to 127.0.0.1" | tee -a "$LOG"

  # Verify the change
  grep -i "listen-ip" "$ESL_CONFIG" | tee -a "$LOG"
else
  echo "[$(date)] WARNING: ESL config not found" | tee -a "$LOG"
fi

# Firewall: Block external access to ESL port 8021
if command -v iptables &>/dev/null; then
  iptables -C INPUT -p tcp --dport 8021 -s 127.0.0.1 -j ACCEPT 2>/dev/null || \
    iptables -I INPUT -p tcp --dport 8021 -s 127.0.0.1 -j ACCEPT
  iptables -C INPUT -p tcp --dport 8021 -j DROP 2>/dev/null || \
    iptables -A INPUT -p tcp --dport 8021 -j DROP
  echo "[$(date)] iptables: ESL port 8021 restricted to localhost" | tee -a "$LOG"
fi

if command -v firewall-cmd &>/dev/null; then
  firewall-cmd --permanent --remove-port=8021/tcp 2>/dev/null || true
  firewall-cmd --permanent --new-zone=freeswitch-esl 2>/dev/null || true
  firewall-cmd --permanent --zone=freeswitch-esl --add-source=127.0.0.1/32 2>/dev/null || true
  firewall-cmd --permanent --zone=freeswitch-esl --add-port=8021/tcp 2>/dev/null || true
  firewall-cmd --reload 2>/dev/null || true
  echo "[$(date)] firewalld: ESL port 8021 restricted" | tee -a "$LOG"
fi

# --- STEP 4: Restrict SIP signaling to known trunk/provider IPs ---
echo "[$(date)] Reviewing SIP port exposure (5060/5061)..." | tee -a "$LOG"
echo "[$(date)] NOTE: Manually restrict SIP ports to known provider IPs." | tee -a "$LOG"
echo "[$(date)] Example: iptables -A INPUT -p udp --dport 5060 -s YOUR_SIP_PROVIDER_IP -j ACCEPT" | tee -a "$LOG"
echo "[$(date)]          iptables -A INPUT -p udp --dport 5060 -j DROP" | tee -a "$LOG"

# --- STEP 5: Restrict WebRTC/Verto ports ---
echo "[$(date)] Reviewing Verto/WebRTC port exposure (8081/8082)..." | tee -a "$LOG"
if command -v iptables &>/dev/null; then
  iptables -C INPUT -p tcp --dport 8081 -j DROP 2>/dev/null || \
    iptables -A INPUT -p tcp --dport 8081 -j DROP 2>/dev/null || true
  iptables -C INPUT -p tcp --dport 8082 -j DROP 2>/dev/null || \
    iptables -A INPUT -p tcp --dport 8082 -j DROP 2>/dev/null || true
  echo "[$(date)] Verto ports blocked. Re-enable for trusted sources if WebRTC is required." | tee -a "$LOG"
fi

# --- STEP 6: Check for suspicious persistence mechanisms ---
echo "[$(date)] Checking for suspicious persistence..." | tee -a "$LOG"

# Check for recently created/modified cron jobs
for cronfile in /etc/crontab /etc/cron.d/* /var/spool/cron/*; do
  if [ -f "$cronfile" ] && [ "$(find "$cronfile" -mtime -3 2>/dev/null)" ]; then
    echo "[$(date)] ALERT: Recently modified cron file: $cronfile" | tee -a "$LOG"
    cat "$cronfile" | tee -a "$LOG"
  fi
done

# Check for suspicious files in tmp
find /tmp /var/tmp -type f -mtime -3 -executable 2>/dev/null | while read -r f; do
  echo "[$(date)] ALERT: Recently created executable in temp: $f" | tee -a "$LOG"
done

# Check for SSH keys added recently
find /home /root -name "authorized_keys" -mtime -3 2>/dev/null | while read -r f; do
  echo "[$(date)] ALERT: Recently modified authorized_keys: $f" | tee -a "$LOG"
  cat "$f" | tee -a "$LOG"
done

# --- STEP 7: File permission audit ---
echo "[$(date)] Auditing FreeSWITCH configuration file permissions..." | tee -a "$LOG"
if [ -n "$FS_CONF" ]; then
  # Ensure config files are not world-readable (they contain credentials)
  find "$FS_CONF" -type f -name "*.xml" -perm /o+r | while read -r f; do
    chmod o-r "$f"
    echo "[$(date)] Hardened permissions: $f" | tee -a "$LOG"
  done
fi

# --- STEP 8: Check if FreeSWITCH is running as root (bad practice) ---
FS_USER=$(ps -eo user,comm | grep freeswitch | head -1 | awk '{print $1}' 2>/dev/null || echo "unknown")
if [ "$FS_USER" = "root" ]; then
  echo "[$(date)] CRITICAL: FreeSWITCH is running as root! Reconfigure to run as 'freeswitch' user." | tee -a "$LOG"
else
  echo "[$(date)] FreeSWITCH running as user: $FS_USER" | tee -a "$LOG"
fi

# --- STEP 9: Summary ---
echo "" | tee -a "$LOG"
echo "============================================================" | tee -a "$LOG"
echo "CVE-2026-116779 Mitigation Summary" | tee -a "$LOG"
echo "============================================================" | tee -a "$LOG"
echo "[$(date)] Completed initial mitigation steps." | tee -a "$LOG"
echo "" | tee -a "$LOG"
echo "IMMEDIATE NEXT STEPS:" | tee -a "$LOG"
echo "  1. APPLY THE VENDOR PATCH from SignalWire immediately." | tee -a "$LOG"
echo "  2. Review forensic snapshot at: $SNAPSHOT_DIR" | tee -a "$LOG"
echo "  3. Restart FreeSWITCH to apply ESL config changes: systemctl restart freeswitch" | tee -a "$LOG"
echo "  4. Rotate ALL SIP credentials, API keys, and TLS certificates." | tee -a "$LOG"
echo "  5. Review CDR (Call Detail Records) for unauthorized calls (toll fraud)." | tee -a "$LOG"
echo "  6. If compromise is suspected, initiate full IR per CISA Forensics Triage Requirements." | tee -a "$LOG"
echo "  7. Report confirmed compromise to CISA at report@cisa.gov." | tee -a "$LOG"
echo "" | tee -a "$LOG"
echo "Log file: $LOG" | tee -a "$LOG"